SOC 2 readiness program
A 90-day program that takes you from no formal compliance work to ready for a SOC 2 Type II audit window.
- 90 days to audit-ready
- $40,000 to $75,000, fixed after scoping
- Discovery in weeks 1 and 2, roadmap in week 3. By day 30 you have a written gap analysis, an approved plan, and your compliance platform connected.
Who this fits
SOC 2 readiness fits SaaS companies with 30 to 200 employees going through SOC 2 for the first time, with production already running on AWS, Google Cloud or Azure. There is usually a date driving it: a prospect needs the report this year, a customer asked at renewal, or sales is planning an enterprise push.
What is included
- Gap analysis against the SOC 2 Trust Services Criteria
- 12 to 15 written policies, including access control, incident response and vendor management
- Compliance platform setup and evidence collection
- Control rollout: MFA everywhere, vulnerability management, quarterly access reviews
- Internal mock audit
- Audit firm selection and kickoff
The first three phases
Every SOC 2 readiness engagement opens with the same phases of the Northstar Maturity Framework.
| Phase | Length | What happens | What you keep |
|---|---|---|---|
| 1Discovery | 2 weeks | Data-flow map, frameworks in scope, and where your program stands today. | Discovery Document, 6 to 12 pages |
| 2Roadmap | 1 week | Prioritized work with owners and a budget, reviewed with your leadership team. | 12-month roadmap |
| 3Build | 8 to 16 weeks | Policies written, controls configured, and your compliance platform collecting evidence. | Policies, controls and evidence collection in place |
-
1Discovery 2 weeks
Data-flow map, frameworks in scope, and where your program stands today.
You keep: Discovery Document, 6 to 12 pages
-
2Roadmap 1 week
Prioritized work with owners and a budget, reviewed with your leadership team.
You keep: 12-month roadmap
-
3Build 8 to 16 weeks
Policies written, controls configured, and your compliance platform collecting evidence.
You keep: Policies, controls and evidence collection in place
Other services
-
Part-time CISO (vCISO)
Mara joins your leadership meeting every week, owns the security roadmap, and answers customer security questions for you.
- Length
- 6 to 18 months
- Price
- $8,000 to $18,000 a month
-
Security assessment
A 2 to 3 week review of your security against NIST CSF, CIS Controls or SOC 2, delivered as a written report with a ranked list of fixes.
- Length
- 2 to 3 weeks
- Price
- $15,000 to $30,000
-
Security awareness training
Live onboarding sessions, quarterly phishing tests and short monthly scenarios, written for engineering-heavy teams.
- Length
- 12 months, renewed yearly
- Price
- $24,000 to $48,000 a year
Common questions
Anything else goes on the fit call, or email hello@northstar-demo.example.
A vCISO engagement is $8,000 to $18,000 a month depending on scope. A SOC 2 readiness program is $40,000 to $75,000 for 90 days. An assessment is $15,000 to $30,000. You get a written scope and a fixed price after the fit call, before anything is signed.
90 days from kickoff to audit-ready if you already have cloud infrastructure, source control and single sign-on in place. Starting from scratch takes 4 to 5 months. The audit window itself adds 3 to 12 months for Type II, set by you and your auditor.
Northstar works with SaaS companies under 200 employees, including B2B fintech. Hardware, government contractors and companies over 250 people get a referral to a firm that specializes in them.
It takes 30 minutes. Mara asks what is driving the work, such as a deal, an audit date, an incident or a board request. If Northstar fits, you get a written scope and price within three business days. If it does not, she names a firm that does.
Mara Chen, on every engagement. Northstar does not subcontract. Penetration tests are run by an outside firm you contract directly, and Mara coordinates them.
Yes. When a client is ready, Mara helps write the job description, sits in on interviews, and hands over the program. The engagement has a 30-day exit clause for this.
Most clients move to a one-day-a-month retainer covering quarterly reviews, preparation for the annual audit, and incident response readiness.
Book a 30-minute fit call with Mara.
Tell her what is driving the work. If Northstar fits, you get a written scope and price within three business days.